Trust
Security at Cursyv.
Direct, current practice. Formal certifications and a public subprocessor list arrive alongside production billing.
Transport encryption
TLS on every production endpoint we control. No plain-HTTP fallbacks.
Least privilege
Automation keys are scoped narrowly and rotated as we move from preview to paid tiers.
Provenance over secrecy
Every History entry carries a SHA-256 fingerprint. Authorship is verifiable without trusting us.
Data residency
Postgres + RLS on Supabase. Your manuscript rows aren’t readable by other accounts, full stop.
Responsible disclosure
Report anything you find — we respond within two working days and credit reporters on request.